ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway (CVE-2026-54450)
Description
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, so NAT64 addresses embedding private, loopback, or link-local IPv4 targets are classified as public and allowed. The most direct attacker-controlled path begins when an external OAuth client supplies a client_id URL that CIMDStorageDecorator.GetClient routes through FetchClientMetadataDocument in pkg/oauthproto/cimd/fetch.go; protectedDialerControl in pkg/networking/http_client.go and validateHost in pkg/skills/gitresolver/reference.go share the defective classification but use operator-controlled or user-controlled destinations. On a ToolHive host behind a NAT64/DNS64 gateway, the gateway translates an allowed address such as 64:ff9b:1::a9fe:a9fe to 169.254.169.254, permitting blind probing of internal TCP or TLS reachability. The attacker-controlled CIMD path requires HTTPS, verifies certificates, and does not reflect response bodies, so the established impact is an internal reachability oracle rather than metadata credential exfiltration; the webhook client is not affected because it does not use this IP guard. This issue is fixed in version 0.29.1.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ToolHive's SSRF protection mechanism in versions before 0.29.1 fails to classify IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48 as private IP ranges. As a result, addresses embedding private, loopback, or link-local IPv4 targets via NAT64 are incorrectly treated as public and allowed by the networking.IsPrivateIP function. This flaw can be exploited when an external OAuth client supplies a client_id URL routed through internal components that use the defective IP classification. On hosts behind a NAT64/DNS64 gateway, this allows attackers to perform blind probing of internal TCP or TLS services, effectively acting as an internal reachability oracle. The vulnerability requires HTTPS with certificate verification and does not reflect response bodies, limiting impact to reconnaissance rather than data exfiltration. The webhook client is unaffected. The vulnerability is addressed in ToolHive version 0.29.1.
Potential Impact
The vulnerability allows an attacker to bypass SSRF IP filtering by exploiting unrecognized IPv6 NAT64 address ranges, enabling blind probing of internal network services behind a NAT64 gateway. This can reveal internal service availability but does not lead to metadata or credential leakage. The impact is limited to internal reachability information disclosure.
Mitigation Recommendations
Upgrade ToolHive to version 0.29.1 or later, where the IPv6 NAT64 prefixes are correctly classified as private and blocked by the SSRF guard. No other mitigation is required as the issue is fixed in this official release.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-pph6-vfjv-vpjw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-54450"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6a58b41668715ace43d68595
Added to database: 07/16/2026, 10:36:06 UTC
Last enriched: 09/15/2026, 22:16:31 UTC
Last updated: 10/17/2026, 18:48:20 UTC
Views: 208
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.